Outsourcing Software Development from the UK: Contracts, UK GDPR, IP and Working Hours

UK businesses can outsource software development to an overseas team safely if five things are in place: a written contract with a clear scope and milestones, a data processing agreement if the team will touch personal data, an approved transfer mechanism such as the UK International Data Transfer Agreement, a written assignment of intellectual property to you, and a few hours of overlapping working time each day. India is 5 hours 30 minutes ahead of the UK in winter and 4 hours 30 minutes ahead during British Summer Time, so a UK morning is an Indian afternoon.

This guide uses the property management system we built for Metroletts, a UK letting agency, as the example.

What we built for a UK letting agency

Metroletts needed one system for landlords, properties, tenants and viewings, maintenance, inspections and accounts, where every record can involve money or legal obligations. We built role-based dashboards for admin, accountant, inspector and maintenance staff, an inspections mobile web app for use on site, and accounts that settle final rent and amounts owed automatically when a property is archived. The system was refined through rounds of client testing and change requests.

1. A contract with scope, milestones and acceptance

• A written scope, ideally after a clickable prototype you have tried yourself
• Milestones, each with a demo on a staging site and clear acceptance criteria
• Payment tied to accepted milestones rather than a large sum up front
• How change requests are priced and approved
• Which country's law governs the contract, and how disputes are handled
• Support and bug-fix terms after launch

2. UK GDPR: a data processing agreement

If the team will see or host personal data, such as tenants, customers or staff, they act as your processor. UK GDPR requires a written contract with every processor that says what data they handle, for what purpose, how they keep it secure, and that they delete or return it at the end. Ask for test data during development wherever possible, and limit access to live data to the people who need it.

3. Sending personal data to India

The UK has not made an adequacy decision for India, so a transfer of personal data there needs an approved safeguard. The usual choice is the ICO's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, together with a short transfer risk assessment. If the system is hosted on UK or EU servers and the team only works on it remotely, discuss with your adviser how that access is treated.

4. Who owns the code

Under UK copyright law, work created by an outside contractor belongs to the contractor unless it is assigned to you in writing. Make sure the contract assigns the code, designs and documentation to your business on payment, lists any open-source or third-party components and their licences, and gives you access to the source code repository, hosting and domain accounts in your own name.

5. VAT and invoicing

Services bought by a UK VAT-registered business from an overseas supplier are normally accounted for under the reverse charge: the supplier invoices without UK VAT, and you account for the VAT on your own return. Check the treatment with your accountant before the first invoice.

6. Working hours and communication

• Agree a daily overlap window, for example 9am to 1pm UK time
• A weekly demo of working software, not just status reports
• One shared task board where you can see progress and raise changes
• A named project lead who answers on the same day
• WhatsApp or Slack for quick questions, email for decisions you need on record